Document automation is not a single “upload PDF” feature. A reliable system separates reading, understanding, validation, approval and writing to the destination system.
Microsoft describes Document Intelligence as OCR plus document understanding that extracts text, tables, structure and key-value pairs. Its official overview also distinguishes prebuilt and custom models, which is important because invoices, contracts and internal forms do not have the same schema.
Step 1: preserve the original
Store the original file with a stable identifier, checksum, source, receive time and access policy. Never make the extracted text the only record.
Reject unsupported, encrypted, corrupted or oversized files before model processing. Keep malware scanning and file validation outside the model.
Step 2: classify before extracting
Identify whether the file is an invoice, contract, receipt, form or unknown document. Classification selects the correct schema and validation rules.
Low-confidence or mixed documents go to a person. Forcing the wrong schema creates plausible fields with the wrong meaning.
Document classification and extraction are two of the processes mapped in 15 Business Processes You Can Automate with AI.
Step 3: extract candidates with provenance
For every field, keep the value, page, bounding region, confidence and extraction method. A reviewer should be able to return to the exact part of the original.
The Microsoft invoice model documentation lists fields such as supplier, billing address, due date, amount and line items. The contract model returns parties, jurisdiction, contract ID and title as structured data.
These outputs are candidates, not approved business records.
Step 4: validate with deterministic rules
Use code, database constraints and reference data for these checks. A language model should not be the calculator or the final authority.
- required fields are present;
- dates use a valid format and logical order;
- currency is explicit and permitted;
- line totals, tax and grand total reconcile;
- supplier or customer exists in the master data;
- invoice number is not a duplicate;
- contract parties match the expected entities;
- signature detection is not treated as identity verification.
Step 5: design human review around risk
Show the original beside extracted fields and highlight low-confidence or rule-breaking values. Let the reviewer correct data and record the reason.
Require approval for high amounts, new suppliers, unusual payment details, missing pages, handwritten changes and legally significant clauses.
Use the controlled rollout gates from the AI Implementation Roadmap before allowing automatic writes.
Step 6: write once and keep the audit trail
Create an idempotency key so a retry cannot post the same document twice. Record the source file, extracted version, validation result, reviewer and destination record ID.
If the downstream API fails, keep the document in a recoverable queue. Do not rerun extraction silently and lose the reviewed version.
Protect sensitive document data
ICO guidance connects AI security with data minimisation. Its official guidance asks organisations to determine which personal data is genuinely necessary and how it is protected.
Encrypt storage and transport, restrict roles, separate test from production, define retention and prevent full documents from appearing in logs or prompts when only a few fields are required.
The same principle applies to customer messages in AI Customer Support Automation.
Measure the full pipeline
The Microsoft content-processing architecture explicitly combines extraction, schemas, confidence and user validation. Measure accepted records, not just OCR output.
- classification accuracy;
- field accuracy by document type;
- straight-through processing rate;
- human correction time;
- duplicate and reconciliation failures;
- exception reasons;
- cost and latency per accepted document;
- security and access incidents.
What document work taught me
When working with invoices, contracts and PDFs, I learned to treat extraction and document creation as separate responsibilities.
A model can find company details, vehicle data, amounts or clauses, but the final document still needs deterministic checks against the supplied source: exact legal name, identifier, totals, dates and requested structure.
The most expensive errors were not unreadable text. They were clean-looking documents with one wrong entity, number or missing condition. That is why provenance and field-level review matter.
Questions and answers
Is OCR the same as document AI?
No. OCR reads characters; document AI also classifies files, identifies structure and maps values into a schema.
Can invoices be posted automatically?
Only after deterministic validation, duplicate protection, master-data checks and risk-based approval have been proven.
Can AI verify a signature?
A system may detect that a signature mark is present. That is not proof of the signer's identity or legal validity.
What should a reviewer see?
The original page, highlighted source region, extracted value, confidence, failed rules and the destination field.
How should corrections be used?
Store them with reasons, analyze recurring failures and use approved examples for evaluation or model improvement.